Score:1

Delete files from root owned folders without sudo

cn flag

There is an application that creates logs owned by root user (this cannot be changed, at least in my work environment) in the directory logs: enter image description here

This app is executed through a docker-compose and Makefile, and it will be stopped and resumed several times. So I want to execute the app, it will generate logs, stop the app and delete the logs and after a certain amount of time, execute the app again, which will generate new logs.

Deleting the logs (all the subfolders and files that are within the logs folder) has to be done with the command rm -rf logs, without sudo involved, because it is made by a Makefile that is also executed in Mac computers. In Mac, if you have a sudo command, it will ask for a password, and I don't want that.

I have added write permissions to the folder with sudo chmod a+rwx and sudo chmod 777 (have tried both because didn't make it work), which according to a few questions might be enough.

I have also added the ubuntu user to the root group as stated in for example https://unix.stackexchange.com/a/139284, with:

adduser ubuntu root

And

usermod -aG root sysadmin

Following this, https://askubuntu.com/a/213959/999435, I have restarted the server after that.

But still, I am unable to remove the files. How could I do this?

pLumo avatar
in flag
Please tell us what is your initial problem, why do you need to delete this files without using `sudo` ? Please also read https://meta.stackexchange.com/questions/66377/what-is-the-xy-problem
cn flag
Thanks. I deploy an app both in locals MAC and an Ubuntu EC2 with a Makefile that has a command that stops a docker-compose and removes the logs. If I add a sudo to the rm, in my mac I need to introduce a password, which I don't want to happen. Hence the non-sudo removing need
bac0n avatar
cn flag
To remove the content of logs you have to do `rm -rf logs/*`, setting the group to users group `chown root.bac0n logs`, then `chmod 775 logs` is probably better than 777.
cn flag
"this cannot be changed" 100% certain it can be changed: airflow uses a user airflow that is part of the root group. `sudo chmod 777` is never the correct answer. @bac0n I would even claim more than 750 is a security issue. "adduser ubuntu root" Sorry? No just no.
bac0n avatar
cn flag
@Rinzwind: I should have been clearer, skip this with adduser and usermod, you only need to change the group on `logs` to the user that should have the right to remove the content of `logs/*` (in this case, it seems to be ubuntu) if there are multiple users in need of removing the content, there is the possibility to create a common group, but it still needs at least `770`.
muru avatar
us flag
It shouldn't be that hard to add a check to your Makefile to use `sudo` only if on Linux.
Score:0
by flag

Use sudo chown -R user: directory_name

cn flag
Thanks for your answer. Then, the app is no longer available to create new logs. Sorry I didn't explain that in the description. I have updated the question
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.